GMO's Onamae Desktop Cloud Breach: Back Up, Disconnect and Power Off Your PC, GMO Tells Customers

TL;DR: GMO Internet says an attacker broke into Onamae Desktop Cloud (お名前.com デスクトップクラウド), its Japanese cloud desktop service, which many customers used to run FX and stock-trading tools such as MT4/MT5, and planted malicious programs on customer servers. GMO says up to 26,739 servers may be affected and trading-account logins may have been stolen. After the attacker threatened a ransomware attack, GMO told customers to back up their files, disconnect their PCs, power them off and unplug them. GMO says it won’t pay the roughly ¥8 billion demand.

What to do now

GMO’s own steps, from its October 23, 26 and 27 notices (our translation):

1. Scan. Run a full antivirus scan, not a quick scan, on each PC and phone you used to connect to Onamae Desktop Cloud.
2. Back up, then power off. GMO wrote: “バックアップを取得したうえで、ネットワークを切断、電源を落とし、PCにつながっているコードを抜いてください” (“After taking a backup, disconnect the network, turn off the power and unplug the cords connected to your PC”). It asks for backups to an external drive made while the PC is off the network.
3. Protect your accounts from another device. Change passwords for trading accounts and tools such as MT4/MT5, email and Google, and end all logged-in sessions. GMO warns that some brokers keep old sessions alive after a password change, so ask your broker to cut them. Turn on two-factor authentication, and remove linked apps, forwarding rules, extensions and devices you don’t recognize.
4. Check your trading accounts for trades or balance changes you didn’t make, and report them to your broker.
5. Don’t open the leak site. GMO says the attacker collects the information of anyone who visits, and it asks people not to share links to it. If you already visited, GMO asks you to run a full scan.
6. Watch for scams. GMO says it never asks for passwords or authentication codes. Ignore anyone offering to recover lost money for a fee.

What happened

GMO says a customer inquiry on October 19, 2026, led it to find malicious programs planted on some customers’ servers on October 20. It stopped new sign-ups and the control panel, and from 4 a.m. Japan time (3 a.m. Manila) on October 21 began shutting down the servers for every plan. In its first notice, it said 26,739 servers may be affected; it later stressed that this is the number of servers that could be affected, not confirmed break-ins. GMO says it doesn’t keep payment card details on the service, but anything customers stored on their servers, including saved trading-account logins, is in scope. It has received customer reports of trades they didn’t make.

GMO says it received a threatening email on October 21 demanding about ¥8 billion (約80億円), and that it will “never” meet the attacker’s demands. On October 27, GMO said the attacker had threatened to publish customer data and launch a ransomware attack at noon Japan time (11 a.m. Manila), and asked customers to power off their PCs before then. That afternoon, GMO said the attacker had published data it claims is about GMO and its customers, which GMO is checking, and that no ransomware attack had been seen as of 1:55 p.m. Japan time (12:55 p.m. Manila). On October 28, GMO said the domain of the attacker’s site had been taken down at about 4 a.m. Japan time (3 a.m. Manila).

GMO is paying every customer ¥5,000 and compensating losses from unauthorized trades, and says it will pay up to ¥3 million more to customers whose data it confirms was published. It is working with police, and says Trend Micro and other companies have offered help. The service has no restart date.

Why it matters

Customers used these cloud desktops to run trading software, so stolen logins can mean direct financial losses. GMO hasn’t said how the attacker got in, and it is still examining customer PCs to learn whether malware reached them, which is why it asked customers to take their own PCs offline.

Updates

• Oct 28, 2026, 11:45 a.m. Manila: First published. GMO hasn’t given a restart date or said how the attacker got in; we’ll add a dated note when it does.

Sources & method

Sources

• GMO Internet, report 1, Oct 21, 2026 (Japanese)
• GMO Internet Group, report 3, Oct 23, 2026 (Japanese)
• GMO Internet Group, report 6, “改めてのお願い,” Oct 26, 2026 (Japanese)
• GMO Internet Group, report 8, Oct 27, 2026 (Japanese)
• GMO Internet Group, report 10, Oct 27, 2026 (Japanese)
• GMO Internet Group, report 12, Oct 27, 2026 (Japanese)
• GMO Internet Group, report 13, Oct 28, 2026 (Japanese)
• BleepingComputer, “Japan’s GMO urges customers to shut down PCs amid ransomware threat,” Oct 27, 2026

Method. Checked October 28, 2026, at 11:05 a.m. Manila time (03:05 UTC). The dates, the 26,739 figure, the ¥8 billion demand, the compensation and the customer steps come from GMO’s own notices; translations from Japanese are ours, and times in GMO’s notices are Japan time, one hour ahead of Manila. BleepingComputer’s report was used to cross-check. Steps labelled “our advice” are our own judgment, not GMO’s. The thumbnail is the preview image from GMO Internet Group’s website. No affiliate links on this page. How we work.